Cysta | |
---|---|
Type | File virus |
Creator | |
Date Discovered | 1993.06 |
Place of Origin | Poland |
Source Language | |
Platform | DOS |
File Type(s) | .com, .exe |
Infection Length | 2,711 - 2,726 bytes |
Reported Costs |
Cysta also known as Comsysexe is a Polish virus from 1993.
Behavior
When Cysta is executed, it installs itself in memory just below the 640k boundary. It takes up 2,736 bytes in memory. Cysta will first infect COMMAND.COM. It then appends itself to any .com and .exe files that are executed or opened in any way. It will change the attributes of some hidden files to make them visible.
The virus body contains the folloing text: "(C) 1992 Cysta Inc." "COMSYSEXEIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYPSQVW" "GAME" "ENJO" "DZOJ" "DZOY" "PLAY" "FUCK" "DUPA" "PORNO" "JOY" "GRY" "RETAL" "GIER" "HUJ" "MKS" "VIRUS" "WIRUS" "SEX" "SONG" "GIF" "WOLF3D" "F19 \" "Enter NEW Password :" "NEW Password Installed" "ERROR, Press Any Key…." "Use Maximum 6 ASCII Characters" "ESC:Exit" and "Hit <ESC>, If you want to". Huj and Dupa are Polish obscenities.
Variants
There are two Cysta variants released in Poland in the same month. One is 2,954 to 2,969 bytes long and 2,976 bytes in memory. The text is different with all strings except that beginning with "COMSYSEXE" eliminate. Added is the text "To jest kodowana metka ! ABC123", which translates to "This is a coded tag !".
The other is 8,045 to 8,060 and 8,064 bytes in memory. It contains the texts "(C) By Rycho Rak", and "COMSYSEXEIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYCOMMANDMKS-VIRMKS_VIRMKSVIRMKS-DEMOMKS_DEMOMKSDEMOPSQVW". A third variant is similar to this one, but it is 8.053 bytes long.
Name
Cysta takes its name from the Cysta Inc. text contained in the virus body. Its other name, Comsysexe, also comes from text contained in the body. Cysta is Polish for microbial cyst. The word that covers all kinds of cysts in Polish is torbiel.
Sources
Patricia Hoffman. Online VSUM, Cysta Virus.